
Introduction
Coordinated networks of inauthentic accounts continue to spread political content and pro-Kremlin disinformation
on X, with limited oversight from the platform. Since early 2024, Reset Tech has been monitoring the activities of a
specific campaign, attributing it to a distinct branch of the Doppelganger operation.
We initially reported on this campaign in July 2024,
identifying two key tactics used by its operators:
leveraging verified accounts to disseminate content
directly within X—avoiding external links—and
exploiting trending hashtags to increase visibility to
targeted audiences. While the Doppelganger operation
is primarily known for using accounts to share links
to domains that impersonate legitimate news sites,
we attributed this campaign to Doppelganger due
to the notable content similarities, references to
reputable media outlets, and overlapping narratives.
Both campaigns clearly align with the Kremlin’s
political agenda, sharing objectives such as tarnishing
Ukraine’s reputation, discouraging Western support
for Ukraine, sowing division between EU allies, and
fostering support for Russia.
Unlike Doppelganger, the content distributed in
this campaign is specifically designed for direct
consumption within the platform, videos being the
preferred content type. In this way, the actors align
their dissemination strategy with that of another
pro-Kremlin Foreign Information Manipulation and
Interference (FIMI) campaign, Operation Overload,
investigated by Reset Tech and the Finnish company
CheckFirst in June 2024. Like Overload, the content
shared on X is confined to the platform and places a
strong emphasis on video. However, from a content
standpoint, the analyzed campaign differs significantly
from Overload. Unlike Overload, the campaign’s
activities on X are multilingual, targeting a broader
audience instead of just the research community. Thus,
the operators align more closely with Doppelganger’s
objective of flooding online information spaces with
pro-Kremlin content in multiple languages.
Referring to reputable media outlets to boost
the credibility of Kremlin propaganda appears to
be a common tactic in pro-Russian operations.
Doppelganger employs cloned media domains for this,
while campaigns like Overload and the one examined
in this report reference established Western outlets as
sources, either in the copy of the social media posts
or through logos embedded in various media formats.
Recently, several reports have explored the
Doppelganger operation on X, albeit with a cursory
focus on this specific campaign. For instance, in June
2024, the German Ministry of Foreign Affairs released
an extensive report on Doppelganger’s activities on X,
noting that content is also being shared without links.
In September 2024, Alliance4Europe/CeMAS and
researchers from the Counter Disinformation Network
(CDN) also published a report on the operation on X,
highlighting several posts that did not include any
associated URLs.
This report provides a comprehensive overview of the
campaign over the past five months. It emphasizes the
consistent tactics used and examines how the platform
has responded to the coordinated behavior of a network
of inauthentic accounts. Additionally, we expanded
our research to map a larger network of dormant
X accounts that could be reactivated at any time.
Since the release of our first report in July 2024, the
network has continued to generate content related
to the campaign at double the capacity. We identified
530 inauthentic anonymous accounts between June
and October 2024. This network generated at least
16,000 posts during that period.
6
Veried Disinformation:
How X Prots From the Rise
of a Pro-Kremlin Network